Most recent entries from all

EUVD-2026-238561

fkie_cve-2022-43409

Jenkins Pipeline: Supporting APIs Plugin 838.va_3a_087b_4055b and earlier does not sanitize or properly encode URLs of hyperlinks sending POST requests in build logs, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to create Pipelines.

GHSA-64r9-x74q-wxmh — Stored XSS vulnerability in Jenkins Pipeline: Supporting APIs Plugin

Affected: Maven: org.jenkins-ci.plugins.workflow:workflow-support

Pipeline: Supporting APIs Plugin provides a feature to add hyperlinks, that send POST requests when clicked, to build logs. These links are used by Pipeline: Input Step Plugin to allow users to proceed or abort the build, or by Pipeline: Job Plugin to allow users to forcibly terminate the build after aborting it.

Pipeline: Supporting APIs Plugin 838.va_3a_087b_4055b and earlier does not sanitize or properly encode URLs of these hyperlinks in build logs.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to create Pipelines.

Pipeline: Supporting APIs Plugin 839.v35e2736cfd5c properly encodes URLs of these hyperlinks in build logs.

gsd-2022-43409

RHSA-2023:0560 — Red Hat Security Advisory: OpenShift Container Platform 4.10.51 security update

google-oauth-client: missing PKCE support in accordance with the RFC for OAuth 2.0 for Native Apps can lead to improper authorization snakeyaml: Denial of Service due to missing nested depth limitation for collections plugin: CSRF vulnerability in Script Security Plugin plugin: User-scoped credentials exposed to other users by Pipeline SCM API for Blue Ocean Plugin plugin: CSRF vulnerability in Blue Ocean Plugin plugin: missing permission checks in Blue Ocean Plugin jenkins-plugin: Cross-site Request Forgery (CSRF) in org.jenkins-ci.plugins:git plugin: Lack of authentication mechanism in Git Plugin webhook plugin: Lack of authentication mechanism in Git Plugin webhook plugin: Non-constant time webhook signature comparison in GitHub Plugin jenkins-plugin/script-security: Sandbox bypass vulnerabilities in Jenkins Script Security Plugin jenkins-plugin/workflow-cps: Sandbox bypass vulnerabilities in Pipeline: Groovy Plugin jenkins-plugin/script-security: Sandbox bypass vulnerabilities in Jenkins Script Security Plugin jenkins-plugin/script-security: Sandbox bypass vulnerabilities in Jenkins Script Security Plugin jenkins-plugin/pipeline-groovy-lib: Sandbox bypass vulnerability in Pipeline: Groovy Libraries Plugin jenkins-plugin/workflow-cps-global-lib: Sandbox bypass vulnerability in Pipeline: Deprecated Groovy Libraries Plugin jenkins-plugin/pipeline-input-step: CSRF protection for any URL can be bypassed in Pipeline: Input Step Plugin jenkins-plugin/pipeline-stage-view: CSRF p…

WID-SEC-W-2022-1804 — Jenkins Plugins: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in verschiedenen Jenkins Plugins ausnutzen, um beliebigen Programmcode auszuführen, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuführen oder Sicherheitsvorkehrungen zu umgehen.